CVE-2026-21113Medium· 5.5▾ SunlitImproper export of android application components in Visual Voicemail prior to version 20.1.00.05 allows local attackers to initiate call without proper permission.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 30.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 10.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.09%
Last analysed / modified upstream
4.8 → 5.5
0.09% → 0.1%
Improper export of android application components in Visual Voicemail prior to version 20.1.00.05 allows local attackers to initiate call without proper permission.
visual_voicemail < 20.1.00.05Upgrade past the affected range:
visual_voicemail 20.1.00.05Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-21108Medium· 5.5Improper export of android application components in Bixby Touch prior to version 4.3.01.17 allows local attackers to access sensitive information.
CVE-2026-21112Medium· 5.5Improper input validation in Samsung Tips prior to Android 17 allows local attackers to launch arbitrary activity with Samsung Tips privilege
CVE-2026-21107Medium· 5.5Out-of-bounds write in Samsung Notes prior to version 4.4.45.5 allows local attackers to write out-of-bounds memory.
CVE-2026-21105Medium· 5.5Improper access control in Collection prior to version 1.0.1.14 in Android 15 and 2.0.02.7 in Android 16 allows local attackers to access sensitive information.
CVE-2020-26144Medium· 6.5An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices
CVE-2025-21043High· 8.8Out-of-bounds write in libimagecodec.quram.so prior to SMR Sep-2025 Release 1 allows remote attackers to execute arbitrary code.